Migrate Local Linux Users and Groups to OpenLDAP

objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount

objectClass: top
objectClass: posixGroup

sudo install -d -m 0700 /root/local-account-migration

sudo cp -a /etc/passwd /etc/group /etc/shadow /etc/gshadow /root/local-account-migration/

grep -E '^(UID_MIN|UID_MAX|GID_MIN|GID_MAX)' /etc/login.defs

awk -F: '
  $3 >= 1000 {
    printf "%-20s uid=%-8s gid=%-8s home=%-30s shell=%s\n",
           $1, $3, $4, $6, $7
  }
' /etc/passwd

awk -F: '
  $7 ~ /(nologin|false)$/ {
    print $1 ":" $3 ":" $7
  }
' /etc/passwd

jdoe
asmith
bwilson

jdoe
asmith
bwilson
developers
operations
linux-admins

LDAP_EXPORT_TMP=$(mktemp)

if ! ldapsearch -x -ZZ -o ldif-wrap=no -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -b "dc=example,dc=com" -LLL "(|(objectClass=posixAccount)(objectClass=posixGroup))" dn objectClass uid cn uidNumber gidNumber homeDirectory loginShell memberUid > "$LDAP_EXPORT_TMP"; then
  rm -f "$LDAP_EXPORT_TMP"
  echo "LDAP identity export failed" >&2
  exit 1
fi

sudo install -m 0600 "$LDAP_EXPORT_TMP" /root/local-account-migration/existing-ldap-identities.ldif

rm -f "$LDAP_EXPORT_TMP"

LDAP_OU_EXPORT_TMP=$(mktemp)

if ! ldapsearch -x -ZZ -o ldif-wrap=no -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -b "ou=people,dc=example,dc=com" -s sub -LLL "(objectClass=*)" dn objectClass uid cn uidNumber gidNumber homeDirectory loginShell > "$LDAP_OU_EXPORT_TMP" || ! ldapsearch -x -ZZ -o ldif-wrap=no -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -b "ou=groups,dc=example,dc=com" -s sub -LLL "(objectClass=*)" dn objectClass cn gidNumber memberUid >> "$LDAP_OU_EXPORT_TMP"; then
  rm -f "$LDAP_OU_EXPORT_TMP"
  echo "LDAP OU export failed" >&2
  exit 1
fi

sudo install -m 0600 "$LDAP_OU_EXPORT_TMP" /root/local-account-migration/existing-ldap-ou-entries.ldif

rm -f "$LDAP_OU_EXPORT_TMP"

awk -F: '{ if ($3 in uid) print "dup uid", $3, $1, uid[$3]; uid[$3]=$1 }' /etc/passwd

awk -F: '{ if ($3 in gid) print "dup gid", $3, $1, gid[$3]; gid[$3]=$1 }' /etc/group

type    name         local-id   ldap-id   result
user    jdoe         10001      -         migrate
user    asmith       10002      12005     conflict
group   developers   10010      10010     existing-match
group   operations   10002      20002     conflict

groups.ldif
users.ldif
memberships.ldif
passwords.ldif
migration-report.tsv
password-report.tsv

sudo install -d -m 0700 /root/local-account-migration

sudo tee /root/local-account-migration/migrate-local-accounts.py > /dev/null <<'EOF'
#!/usr/bin/env python3
"""Generate POSIX migration LDIF with LDAP preflight checks."""

from __future__ import annotations

import base64
import os
import re
import sys
from dataclasses import dataclass, field
from pathlib import Path
from typing import Dict, List, Optional, Set, Tuple

POSIX_NAME = re.compile(r"^[a-z_][a-z0-9_-]{0,31}$")
CRYPT_HASH = re.compile(r"^\$[156]\$")
LDIF_FILES = ("groups.ldif", "users.ldif", "memberships.ldif", "passwords.ldif")
CONFLICT_RESULTS = {
    "name-conflict",
    "numeric-id-conflict",
    "dn-conflict",
    "attribute-mismatch",
    "missing-source-record",
    "missing-primary-group",
    "allowlist-duplicate",
    "local-duplicate-uid",
    "local-duplicate-gid",
    "ldap-duplicate-uid",
    "ldap-duplicate-gid",
    "ldap-duplicate-name",
}


@dataclass
class LdapEntry:
    dn: str
    attrs: Dict[str, List[str]] = field(default_factory=dict)


def read_allowlist(path: Path) -> List[str]:
    names: List[str] = []
    for line in path.read_text().splitlines():
        line = line.strip()
        if not line or line.startswith("#"):
            continue
        names.append(line)
    if not names:
        raise SystemExit(f"allowlist is empty: {path}")
    return names


def parse_passwd(path: Path) -> Dict[str, dict]:
    users: Dict[str, dict] = {}
    for line in path.read_text().splitlines():
        if not line or line.startswith("#"):
            continue
        parts = line.split(":")
        if len(parts) < 7:
            raise SystemExit(f"invalid passwd line: {line}")
        name, _, uid, gid, gecos, home, shell = parts[:7]
        if name in users:
            raise SystemExit(f"duplicate username in passwd snapshot: {name}")
        users[name] = {
            "uid": int(uid),
            "gid": int(gid),
            "gecos": gecos,
            "home": home,
            "shell": shell,
        }
    return users


def parse_group(path: Path) -> Tuple[Dict[str, dict], Dict[int, str]]:
    groups: Dict[str, dict] = {}
    gid_to_name: Dict[int, str] = {}
    for line in path.read_text().splitlines():
        if not line or line.startswith("#"):
            continue
        parts = line.split(":")
        if len(parts) < 4:
            raise SystemExit(f"invalid group line: {line}")
        name, _, gid, members = parts[0], parts[1], parts[2], parts[3] if len(parts) > 3 else ""
        if name in groups:
            raise SystemExit(f"duplicate group name in group snapshot: {name}")
        gid_i = int(gid)
        member_list = [m for m in members.split(",") if m]
        groups[name] = {"gid": gid_i, "members": member_list}
        gid_to_name[gid_i] = name
    return groups, gid_to_name


def parse_shadow(path: Path) -> Dict[str, str]:
    shadow: Dict[str, str] = {}
    if not path.is_file():
        return shadow
    for line in path.read_text().splitlines():
        if not line or line.startswith("#"):
            continue
        parts = line.split(":")
        if len(parts) < 2:
            continue
        shadow[parts[0]] = parts[1]
    return shadow


def parse_ldif_line(raw: str) -> Tuple[str, str]:
    if "::" in raw:
        attr, encoded = raw.split("::", 1)
        value = base64.b64decode(encoded.strip()).decode("utf-8")
        return attr.lower(), value
    attr, value = raw.split(":", 1)
    return attr.lower(), value.lstrip()


def parse_ldap_export(path: Path) -> List[LdapEntry]:
    if not path.is_file():
        return []
    entries: List[LdapEntry] = []
    current: Optional[LdapEntry] = None
    pending_attr: Optional[str] = None
    for raw in path.read_text().splitlines():
        if raw.startswith(" "):
            if current is not None and pending_attr is not None:
                current.attrs[pending_attr][-1] += raw[1:]
            continue
        if raw.startswith("dn::"):
            if current:
                entries.append(current)
            dn = base64.b64decode(raw.split("::", 1)[1].strip()).decode("utf-8")
            current = LdapEntry(dn=dn)
            pending_attr = None
            continue
        if raw.startswith("dn:"):
            if current:
                entries.append(current)
            current = LdapEntry(dn=raw.split(":", 1)[1].lstrip())
            pending_attr = None
            continue
        if current is None:
            continue
        if ":" in raw:
            key, decoded = parse_ldif_line(raw)
            current.attrs.setdefault(key, []).append(decoded)
            pending_attr = key
    if current:
        entries.append(current)
    return entries


def has_objectclass(entry: LdapEntry, name: str) -> bool:
    return name.lower() in [oc.lower() for oc in entry.attrs.get("objectclass", [])]


def build_ldap_indexes(entries: List[LdapEntry]) -> dict:
    idx = {
        "user_dn": {},
        "user_name": {},
        "uidnumber": {},
        "group_dn": {},
        "group_name": {},
        "group_gidnumber": {},
        "ou_dn": {},
    }
    for entry in entries:
        idx["ou_dn"][entry.dn.lower()] = entry
        if has_objectclass(entry, "posixAccount"):
            idx["user_dn"][entry.dn.lower()] = entry
            for uid in entry.attrs.get("uid", []):
                idx["user_name"].setdefault(uid, []).append(entry)
            for num in entry.attrs.get("uidnumber", []):
                idx["uidnumber"].setdefault(int(num), []).append(entry)
        if has_objectclass(entry, "posixGroup"):
            idx["group_dn"][entry.dn.lower()] = entry
            for cn in entry.attrs.get("cn", []):
                idx["group_name"].setdefault(cn, []).append(entry)
            for num in entry.attrs.get("gidnumber", []):
                idx["group_gidnumber"].setdefault(int(num), []).append(entry)
    return idx


def merge_ldap_entries(*entry_sets: List[LdapEntry]) -> List[LdapEntry]:
    by_dn: Dict[str, LdapEntry] = {}

    for entries in entry_sets:
        for entry in entries:
            key = entry.dn.lower()

            if key not in by_dn:
                by_dn[key] = entry
                continue

            existing = by_dn[key]
            for attr, values in entry.attrs.items():
                current = existing.attrs.setdefault(attr, [])
                for value in values:
                    if value not in current:
                        current.append(value)

    return list(by_dn.values())


def first_entry(entries: List[LdapEntry]) -> Optional[LdapEntry]:
    return entries[0] if entries else None


def detect_allowlist_duplicates(
    users_sel: List[str], groups_sel: List[str]
) -> List[Tuple[str, str, str, str, str]]:
    rows: List[Tuple[str, str, str, str, str]] = []

    def scan(kind: str, names: List[str]) -> None:
        seen: Set[str] = set()
        for name in names:
            if name in seen:
                rows.append((kind, name, "-", "-", "allowlist-duplicate"))
            seen.add(name)

    scan("user", users_sel)
    scan("group", groups_sel)
    return rows


def detect_local_duplicates(
    users_sel: List[str],
    groups_sel: List[str],
    passwd: Dict[str, dict],
    groups: Dict[str, dict],
) -> List[Tuple[str, str, str, str, str]]:
    rows: List[Tuple[str, str, str, str, str]] = []
    uid_map: Dict[int, List[str]] = {}
    gid_map: Dict[int, List[str]] = {}
    for uname in users_sel:
        if uname not in passwd:
            continue
        uid_map.setdefault(passwd[uname]["uid"], []).append(uname)
    for gname in groups_sel:
        if gname not in groups:
            continue
        gid_map.setdefault(groups[gname]["gid"], []).append(gname)
    for uid, names in sorted(uid_map.items()):
        if len(names) > 1:
            rows.append(("user", ",".join(names), str(uid), "-", "local-duplicate-uid"))
    for gid, names in sorted(gid_map.items()):
        if len(names) > 1:
            rows.append(("group", ",".join(names), str(gid), "-", "local-duplicate-gid"))
    return rows


def detect_ldap_duplicates(ldap_idx: dict) -> List[Tuple[str, str, str, str, str]]:
    rows: List[Tuple[str, str, str, str, str]] = []
    for uid, entries in sorted(ldap_idx["user_name"].items()):
        if len(entries) > 1:
            dns = ";".join(e.dn for e in entries)
            rows.append(("user", uid, "-", dns, "ldap-duplicate-name"))
    for num, entries in sorted(ldap_idx["uidnumber"].items()):
        if len(entries) > 1:
            dns = ";".join(e.dn for e in entries)
            rows.append(("user", f"uidNumber={num}", str(num), dns, "ldap-duplicate-uid"))
    for cn, entries in sorted(ldap_idx["group_name"].items()):
        if len(entries) > 1:
            dns = ";".join(e.dn for e in entries)
            rows.append(("group", cn, "-", dns, "ldap-duplicate-name"))
    for num, entries in sorted(ldap_idx["group_gidnumber"].items()):
        if len(entries) > 1:
            dns = ";".join(e.dn for e in entries)
            rows.append(("group", f"gidNumber={num}", str(num), dns, "ldap-duplicate-gid"))
    return rows


def escape_rdn(value: str) -> str:
    out = []
    for ch in value:
        if ch in ",+=<>#;\"\\":
            out.append("\\" + ch)
        elif ch == " " and (not out or len(value) - len(out) == 1):
            out.append("\\ ")
        else:
            out.append(ch)
    return "".join(out)


def ldif_line(attr: str, value: str) -> str:
    encoded = value.encode("utf-8")
    unsafe = (
        not value
        or value[0] in " :#<"
        or value[-1] == " "
        or any(b < 32 or b > 126 for b in encoded)
    )
    if unsafe:
        b64 = base64.b64encode(encoded).decode("ascii")
        return f"{attr}:: {b64}"
    return f"{attr}: {value}"


def classify_password(hash_value: Optional[str]) -> str:
    if hash_value is None or hash_value == "":
        return "empty-reset-required"
    if hash_value.startswith("!") or hash_value == "*":
        return "locked-reset-required"
    if CRYPT_HASH.match(hash_value):
        return "hash-preserved"
    return "unsupported-reset-required"


def validate_posix_name(name: str, kind: str) -> None:
    if not POSIX_NAME.match(name):
        raise SystemExit(
            f"unsupported {kind} name {name!r}: use lowercase POSIX names "
            "without LDAP-special characters"
        )


def first_attr(entry: LdapEntry, attr: str, default: str = "") -> str:
    values = entry.attrs.get(attr.lower(), [])
    return values[0] if values else default


def classify_group(
    name: str,
    local_gid: int,
    target_dn: str,
    ldap_idx: dict,
) -> Tuple[str, str]:
    target_dn_l = target_dn.lower()
    by_name = first_entry(ldap_idx["group_name"].get(name, []))
    by_gid = first_entry(ldap_idx["group_gidnumber"].get(local_gid, []))
    dn_entry = ldap_idx["ou_dn"].get(target_dn_l)

    if by_name:
        ldap_gid = int(first_attr(by_name, "gidnumber", "-1"))
        if by_name.dn.lower() != target_dn_l:
            if ldap_gid == local_gid:
                return "dn-conflict", by_name.dn
            return "name-conflict", by_name.dn
        if ldap_gid != local_gid:
            return "attribute-mismatch", by_name.dn
        return "existing-match", by_name.dn
    if by_gid and first_attr(by_gid, "cn") != name:
        return "numeric-id-conflict", by_gid.dn
    if dn_entry:
        return "dn-conflict", dn_entry.dn
    return "migrate", "-"


def classify_user(
    name: str,
    local_uid: int,
    local_gid: int,
    local_home: str,
    local_shell: str,
    target_dn: str,
    ldap_idx: dict,
) -> Tuple[str, str]:
    target_dn_l = target_dn.lower()
    by_name = first_entry(ldap_idx["user_name"].get(name, []))
    by_uid = first_entry(ldap_idx["uidnumber"].get(local_uid, []))
    dn_entry = ldap_idx["ou_dn"].get(target_dn_l)

    if by_name:
        ldap_uid = int(first_attr(by_name, "uidnumber", "-1"))
        ldap_gid = int(first_attr(by_name, "gidnumber", "-1"))
        ldap_home = first_attr(by_name, "homedirectory")
        ldap_shell = first_attr(by_name, "loginshell")

        if by_name.dn.lower() != target_dn_l:
            if ldap_uid == local_uid:
                return "dn-conflict", by_name.dn
            return "name-conflict", by_name.dn

        if ldap_uid != local_uid:
            return "name-conflict", by_name.dn

        if (
            ldap_gid != local_gid
            or ldap_home != local_home
            or ldap_shell != local_shell
        ):
            return "attribute-mismatch", by_name.dn

        return "existing-match", by_name.dn

    if by_uid and first_attr(by_uid, "uid") != name:
        return "numeric-id-conflict", by_uid.dn
    if dn_entry:
        return "dn-conflict", dn_entry.dn
    return "migrate", "-"


def primary_group_ready(
    primary_group: Optional[str],
    gid: int,
    groups_sel: List[str],
    ldap_idx: dict,
) -> Tuple[bool, str]:
    if primary_group is None:
        return False, "-"
    if primary_group in groups_sel:
        return True, "-"
    ldap_group = first_entry(ldap_idx["group_gidnumber"].get(gid, []))
    if ldap_group and first_attr(ldap_group, "cn") == primary_group:
        return True, ldap_group.dn
    return False, ldap_group.dn if ldap_group else "-"


def write_reports(workdir: Path, report_rows: List[str], password_rows: List[str]) -> None:
    workdir.mkdir(parents=True, exist_ok=True)
    (workdir / "migration-report.tsv").write_text("\n".join(report_rows) + "\n")
    (workdir / "password-report.tsv").write_text("\n".join(password_rows) + "\n")
    print(f"Wrote {workdir / 'migration-report.tsv'}")
    print(f"Wrote {workdir / 'password-report.tsv'}")


def remove_ldif_files(workdir: Path) -> None:
    for name in LDIF_FILES:
        path = workdir / name
        if path.exists():
            path.unlink()


def write_migration_ldif(
    workdir: Path,
    groups_ldif: List[str],
    users_ldif: List[str],
    memberships_ldif: List[str],
    passwords_ldif: List[str],
) -> None:
    workdir.mkdir(parents=True, exist_ok=True)
    (workdir / "groups.ldif").write_text("\n".join(groups_ldif))
    (workdir / "users.ldif").write_text("\n".join(users_ldif))
    (workdir / "memberships.ldif").write_text("\n".join(memberships_ldif))
    (workdir / "passwords.ldif").write_text("\n".join(passwords_ldif))
    for name in LDIF_FILES:
        print(f"Wrote {workdir / name}")


def append_report_rows(
    report_rows: List[str], rows: List[Tuple[str, str, str, str, str]]
) -> int:
    conflicts = 0
    for row in rows:
        report_rows.append("\t".join(row))
        if row[4] in CONFLICT_RESULTS:
            conflicts += 1
    return conflicts


def main() -> int:
    os.umask(0o077)
    workdir = Path(os.environ.get("WORKDIR", "/root/local-account-migration"))
    base_dn = os.environ.get("BASE_DN", "dc=example,dc=com")
    people_ou = os.environ.get("PEOPLE_OU", "ou=people")
    groups_ou = os.environ.get("GROUPS_OU", "ou=groups")
    source_host = os.environ.get("SOURCE_HOST", "ldap-server.example.com")

    passwd_path = Path(os.environ.get("PASSWD", workdir / "passwd"))
    group_path = Path(os.environ.get("GROUP", workdir / "group"))
    shadow_path = Path(os.environ.get("SHADOW", workdir / "shadow"))
    users_allow = Path(os.environ.get("USERS_ALLOW", workdir / "users.allowlist"))
    groups_allow = Path(os.environ.get("GROUPS_ALLOW", workdir / "groups.allowlist"))
    ldap_export = Path(
        os.environ.get("LDAP_EXPORT", workdir / "existing-ldap-identities.ldif")
    )
    ldap_ou_export = Path(
        os.environ.get("LDAP_OU_EXPORT", workdir / "existing-ldap-ou-entries.ldif")
    )

    users_sel = read_allowlist(users_allow)
    groups_sel = read_allowlist(groups_allow)
    passwd = parse_passwd(passwd_path)
    groups, gid_to_name = parse_group(group_path)
    shadow = parse_shadow(shadow_path)
    identity_entries = parse_ldap_export(ldap_export)
    ou_entries = parse_ldap_export(ldap_ou_export)
    ldap_entries = merge_ldap_entries(identity_entries, ou_entries)
    ldap_idx = build_ldap_indexes(ldap_entries)

    report_rows = ["type\tname\tlocal-id\tldap-id\tresult"]
    password_rows = ["user\tpassword-status"]
    conflicts = 0

    conflicts += append_report_rows(
        report_rows, detect_allowlist_duplicates(users_sel, groups_sel)
    )
    conflicts += append_report_rows(
        report_rows,
        detect_local_duplicates(users_sel, groups_sel, passwd, groups),
    )
    conflicts += append_report_rows(report_rows, detect_ldap_duplicates(ldap_idx))

    groups_ldif: List[str] = []
    users_ldif: List[str] = []
    memberships_ldif: List[str] = []
    passwords_ldif: List[str] = []
    selected_groups: Set[str] = set()

    for gname in groups_sel:
        validate_posix_name(gname, "group")
        if gname not in groups:
            print(f"missing group entry: {gname}", file=sys.stderr)
            report_rows.append(f"group\t{gname}\t-\t-\tmissing-source-record")
            conflicts += 1
            continue
        gid = groups[gname]["gid"]
        target_dn = f"cn={escape_rdn(gname)},{groups_ou},{base_dn}"
        result, ldap_id = classify_group(gname, gid, target_dn, ldap_idx)
        report_rows.append(f"group\t{gname}\t{gid}\t{ldap_id}\t{result}")
        if result in CONFLICT_RESULTS:
            conflicts += 1
            continue
        selected_groups.add(gname)
        if result == "migrate":
            groups_ldif.extend(
                [
                    f"dn: {target_dn}",
                    "objectClass: top",
                    "objectClass: posixGroup",
                    ldif_line("cn", gname),
                    f"gidNumber: {gid}",
                    ldif_line("description", f"Migrated from {source_host}"),
                    "",
                ]
            )

    for uname in users_sel:
        validate_posix_name(uname, "user")
        if uname not in passwd:
            print(f"missing passwd entry: {uname}", file=sys.stderr)
            report_rows.append(f"user\t{uname}\t-\t-\tmissing-source-record")
            password_rows.append(f"{uname}\tmissing-source-record")
            conflicts += 1
            continue

        data = passwd[uname]
        uid = data["uid"]
        gid = data["gid"]
        target_dn = f"uid={escape_rdn(uname)},{people_ou},{base_dn}"
        primary_group = gid_to_name.get(gid)
        ready, ldap_group_id = primary_group_ready(primary_group, gid, groups_sel, ldap_idx)

        if not ready:
            result = "missing-primary-group"
            ldap_id = ldap_group_id
        else:
            result, ldap_id = classify_user(
                uname,
                uid,
                gid,
                data["home"],
                data["shell"],
                target_dn,
                ldap_idx,
            )

        report_rows.append(f"user\t{uname}\t{uid}\t{ldap_id}\t{result}")
        pwd_status = classify_password(shadow.get(uname))
        password_rows.append(f"{uname}\t{pwd_status}")

        if result in CONFLICT_RESULTS:
            conflicts += 1
            continue
        if result == "existing-match":
            continue

        gecos = data["gecos"]
        cn = gecos.split(",", 1)[0] if gecos else uname
        parts = cn.split()
        given = parts[0] if parts else uname
        sn = parts[-1] if parts else uname

        users_ldif.extend(
            [
                f"dn: {target_dn}",
                "objectClass: top",
                "objectClass: inetOrgPerson",
                "objectClass: posixAccount",
                ldif_line("cn", cn or uname),
                ldif_line("sn", sn),
                ldif_line("givenName", given),
                ldif_line("uid", uname),
                f"uidNumber: {uid}",
                f"gidNumber: {gid}",
                ldif_line("homeDirectory", data["home"]),
                ldif_line("loginShell", data["shell"]),
                ldif_line("gecos", gecos),
                ldif_line("description", f"Migrated from {source_host}"),
                "",
            ]
        )

        if pwd_status == "hash-preserved":
            hash_value = shadow[uname]
            passwords_ldif.extend(
                [
                    f"dn: {target_dn}",
                    "changetype: modify",
                    "replace: userPassword",
                    ldif_line("userPassword", f"{{CRYPT}}{hash_value}"),
                    "",
                ]
            )

    for gname in groups_sel:
        if gname not in groups or gname not in selected_groups:
            continue
        selected_members = [m for m in groups[gname]["members"] if m in users_sel]
        if not selected_members:
            continue
        target_dn = f"cn={escape_rdn(gname)},{groups_ou},{base_dn}"
        ldap_group = first_entry(ldap_idx["group_name"].get(gname, []))
        existing_members = set(ldap_group.attrs.get("memberuid", [])) if ldap_group else set()
        missing_members = sorted(set(selected_members) - existing_members)
        if not missing_members:
            continue
        memberships_ldif.extend(
            [f"dn: {target_dn}", "changetype: modify", "add: memberUid"]
            + [ldif_line("memberUid", m) for m in missing_members]
            + [""]
        )

    write_reports(workdir, report_rows, password_rows)
    if conflicts:
        remove_ldif_files(workdir)
        print(
            f"Preflight failed with {conflicts} unresolved conflict(s)",
            file=sys.stderr,
        )
        return 1

    write_migration_ldif(workdir, groups_ldif, users_ldif, memberships_ldif, passwords_ldif)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

EOF

sudo chmod 0700 /root/local-account-migration/migrate-local-accounts.py

sudo PASSWD=/root/local-account-migration/passwd GROUP=/root/local-account-migration/group SHADOW=/root/local-account-migration/shadow LDAP_EXPORT=/root/local-account-migration/existing-ldap-identities.ldif LDAP_OU_EXPORT=/root/local-account-migration/existing-ldap-ou-entries.ldif python3 /root/local-account-migration/migrate-local-accounts.py

column -t -s $'\t' /root/local-account-migration/migration-report.tsv

column -t -s $'\t' /root/local-account-migration/password-report.tsv

dn: cn=developers,ou=groups,dc=example,dc=com
objectClass: top
objectClass: posixGroup
cn: developers
gidNumber: 10010
description: Migrated from ldap-server.example.com

dn: uid=jdoe,ou=people,dc=example,dc=com
objectClass: top
objectClass: inetOrgPerson
objectClass: posixAccount
cn: John Doe
sn: Doe
givenName: John
uid: jdoe
uidNumber: 10001
gidNumber: 10001
homeDirectory: /home/jdoe
loginShell: /bin/bash
gecos: John Doe
description: Migrated from ldap-server.example.com

dn: cn=linux-admins,ou=groups,dc=example,dc=com
changetype: modify
add: memberUid
memberUid: jdoe
memberUid: asmith

grep '^dn:' /root/local-account-migration/groups.ldif /root/local-account-migration/users.ldif | sort | uniq -d

ldapadd -n -v -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/groups.ldif

ldapadd -n -v -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/users.ldif

ldapmodify -n -v -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/memberships.ldif

ldapmodify -n -v -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/passwords.ldif

sudo slapcat -b "dc=example,dc=com" -l /root/openldap-before-local-user-migration.ldif

1. Groups
2. Users
3. Supplementary memberships
4. Passwords or password resets

ldapadd -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/groups.ldif

ldapadd -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/users.ldif

ldapmodify -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/memberships.ldif

ldapsearch -x -ZZ \
  -H ldap://ldap-server.example.com \
  -D "cn=admin,dc=example,dc=com" \
  -W \
  -b "ou=people,dc=example,dc=com" \
  -LLL \
  "(objectClass=posixAccount)" \
  uid uidNumber gidNumber

ldapsearch -x -ZZ \
  -H ldap://ldap-server.example.com \
  -D "cn=admin,dc=example,dc=com" \
  -W \
  -b "ou=groups,dc=example,dc=com" \
  -LLL \
  "(objectClass=posixGroup)" \
  cn gidNumber memberUid

ldapsearch -x -ZZ \
  -H ldap://ldap-server.example.com \
  -D "uid=sssd-reader,ou=service-accounts,dc=example,dc=com" \
  -W \
  -b "ou=people,dc=example,dc=com" \
  -LLL \
  "(uid=miguser1)" \
  uid uidNumber gidNumber homeDirectory loginShell

ldappasswd -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -S "uid=miguser1,ou=people,dc=example,dc=com"

sudo awk -F: '$1 == "jdoe" {print $2}' /etc/shadow

$6$SALT$HASH

dn: uid=jdoe,ou=people,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: {CRYPT}$6$SALT$HASH

ldapmodify -x -ZZ -H ldap://ldap-server.example.com -D "cn=admin,dc=example,dc=com" -W -f /root/local-account-migration/passwords.ldif

passwd: files sss
group:  files sss

getent passwd miguser1

id miguser1

getent group migdevs

ldapwhoami -x -ZZ -H ldap://ldap-server.example.com -D "uid=miguser1,ou=people,dc=example,dc=com" -W

sudo sssctl user-checks -a auth -s sshd miguser1

sudo sssctl user-checks -a acct -s sshd miguser1

ssh [email protected]

1. Schedule a maintenance window
2. Stop new local account changes
3. Configure and validate SSSD
4. Remove migrated local login entries without deleting home data
5. Expire only affected SSSD caches
6. Verify getent and id return LDAP identities
7. Test password login
8. Test file and home ownership
9. Retain protected local-account backups

sudo userdel jdoe

sudo groupdel developers

sudo sss_cache -u jdoe

getent passwd jdoe

getent passwd 10001

getent group developers

getent group 10010

sudo find / -xdev -uid 10001 -ls

sudo find / -xdev -gid 10001 -ls

/etc/passwd backup
/etc/group backup
/etc/shadow backup
/etc/gshadow backup
OpenLDAP pre-migration LDIF
Generated user and group LDIF
Migration allowlists
Conflict report
SSSD configuration backup
Cutover checklist

sudo sssctl config-check

sudo sssctl domain-status example.com

sudo sss_cache -u jdoe

sudo journalctl -u sssd -n 200 --no-pager

sudo journalctl -u slapd -n 200 --no-pager